Every CVE Search/ Get API key

CVE-2022-25844

Regular Expression Denial of Service (ReDoS)

5.3 MediumFix available

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

4.93%Up 4.0 points since May 2, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

Regular Expression Denial of Service (ReDoS)

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
CVE-2022-25844
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F
Updated
2026-11-02
EUVDEUVD-2022-4470 5.3

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
EUVD-2022-4470
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F
Updated
2026-11-02
GitHub AdvisoriesGHSA-m2h2-264f-f486 5.3

angular vulnerable to regular expression denial of service (ReDoS)

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

Note:

  1. This package has been deprecated and is no longer maintained.
  2. The vulnerable versions are 1.7.0 and higher.
Record
GHSA-m2h2-264f-f486
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770, CWE-1333
Updated
2026-11-02
NVD 5.3

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
CVE-2022-25844
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
CVE-2022-25844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-25844 7.5

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
DEBIAN-CVE-2022-25844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
Show 10 moreShow less
OSVGHSA-m2h2-264f-f486 5.3

angular vulnerable to regular expression denial of service (ReDoS)

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

Note:

  1. This package has been deprecated and is no longer maintained.
  2. The vulnerable versions are 1.7.0 and higher.
Record
GHSA-m2h2-264f-f486
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-1333, CWE-770
Updated
2026-11-02
OSVUBUNTU-CVE-2022-25844 5.3

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Record
UBUNTU-CVE-2022-25844
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1773706637 No score

TuxCare security update for angular (11 CVEs)

TuxCare rebuilt angular to address 11 CVEs. Fixed in 1.8.2-tuxcare.1.

Record
CLSA-2026-1773706637
Updated
2026-11-02
OSVCLSA-2026-1773706638 No score

TuxCare security update for angular (7 CVEs)

TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.7.9-tuxcare.1.

Record
CLSA-2026-1773706638
Updated
2026-11-02
OSVCLSA-2026-1773965926 No score

TuxCare security update for angular (8 CVEs)

TuxCare rebuilt angular to address 8 CVEs. Fixed in 1.8.3-tuxcare.1.

Record
CLSA-2026-1773965926
Updated
2026-11-02
OSVCLSA-2026-1774052351 No score

TuxCare security update for angular (1 CVE)

TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.4.

Record
CLSA-2026-1774052351
Updated
2026-11-02
OSVCLSA-2026-1774052360 No score

TuxCare security update for angular (3 CVEs)

TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.5.11-tuxcare.4.

Record
CLSA-2026-1774052360
Updated
2026-11-02
OSVCLSA-2026-1785381052 No score

TuxCare security update for angular (4 CVEs)

TuxCare rebuilt angular to address 4 CVEs. Fixed in 1.5.10-tuxcare.3.

Record
CLSA-2026-1785381052
Updated
2026-11-02
OSVMGASA-2023-0215 No score

Updated glances packages fix security vulnerability

Regular Expression Denial of Service (ReDoS) in angular (CVE-2022-25844)

Record
MGASA-2023-0215
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2022-25844 No score

CVE-2022-25844 in @rootio/angular - Patched by Root

Root has patched CVE-2022-25844 in the @rootio/angular package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2022-25844
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
angular
npm
 1.7.0 and later None known
angular
TuxCare:npm
From an advisory covering 11 CVEs
 1.8.2-tuxcare.0 up to 1.8.2-tuxcare.1, plus listed versions
1.8.2
1.8.2-tuxcare.1
angular
TuxCare:npm
From an advisory covering 7 CVEs
 1.7.9-tuxcare.0 up to 1.7.9-tuxcare.1, plus listed versions
1.7.9
1.7.9-tuxcare.1
angular
TuxCare:npm
From an advisory covering 8 CVEs
 1.8.3-tuxcare.0 up to 1.8.3-tuxcare.1, plus listed versions
1.8.3
1.8.3-tuxcare.1
angular
TuxCare:npm
 1.6.10-tuxcare.0 up to 1.6.10-tuxcare.4, plus listed versions
1.6.101.6.10-tuxcare.11.6.10-tuxcare.21.6.10-tuxcare.3
1.6.10-tuxcare.4
angular
TuxCare:npm
From an advisory covering 3 CVEs
 1.5.11-tuxcare.0 up to 1.5.11-tuxcare.4, plus listed versions
1.5.111.5.11-tuxcare.11.5.11-tuxcare.21.5.11-tuxcare.3
1.5.11-tuxcare.4
angular
TuxCare:npm
From an advisory covering 4 CVEs
 1.5.10-tuxcare.0 up to 1.5.10-tuxcare.3, plus listed versions
1.5.101.5.10-tuxcare.11.5.10-tuxcare.2
1.5.10-tuxcare.3
angular.js
Debian:12
 before 1.8.3-1+deb12u1, plus listed versions
1.8.3-11.8.3-1+deb12u1~deb11u1
1.8.3-1+deb12u1
angular.js
Debian:13
 before 1.8.3-2
1.8.3-2
angular.js
Debian:11
From an advisory covering 9 CVEs
 before 1.8.3-1+deb12u1~deb11u1, plus listed versions
1.8.2-21.8.3-1
1.8.3-1+deb12u1~deb11u1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
glances
Mageia:8
 before 3.3.1-1.1.mga8
3.3.1-1.1.mga8
@rootio/angular
Root:npm
 before 1.8.3-root.io.1
1.8.3-root.io.11.8.3-root.io.21.8.3-root.io.31.8.3-root.io.41.8.3-root.io.5
angular
Root:npm
 before 1.8.3-aikido.2
1.8.3-aikido.21.8.3-aikido.31.8.3-aikido.41.8.3-aikido.5
angular.js
Ubuntu:Pro:20.04:LTS
 before 1.7.9-1ubuntu0.1~esm1, plus listed versions
1.5.10-11.7.9-1
1.7.9-1ubuntu0.1~esm1
angular.js
Ubuntu:22.04:LTS
 before 1.8.2-2ubuntu0.1, plus listed versions
1.8.2-2
1.8.2-2ubuntu0.1
angular.js
Ubuntu:24.04:LTS
 before 1.8.3-1ubuntu0.24.04.1, plus listed versions
1.8.3-1
1.8.3-1ubuntu0.24.04.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25844 is a medium vulnerability (CVSS 5.3) in Angular, published May 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.93%, the 92nd percentile. Fixed in angular 1.6.10-tuxcare.4.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open